Selfhosted

52449 readers

1230 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago

MODERATORS

HybridSarcasm@lemmy.world

HybridSarcasm@lemmy.hybridsarcasm.xyz

Restricting Docker Socket Proxy by Container (blog.foxxmd.dev)

submitted 1 week ago by tofu@lemmy.nocturnal.garden to c/selfhosted@lemmy.world

8 comments fedilink hide all child comments

Cross posted from: https://lemmy.nocturnal.garden/post/294603

top 8 comments

sorted by: hot top controversial new old

[–] lefaucet@slrpnk.net 3 points 1 week ago (1 children)

Does this apply to podman as well?

[–] tofu@lemmy.nocturnal.garden 1 points 1 week ago (1 children)

Good question, I don't know if Podman has a thing like Docker socket

[–] Static_Rocket@lemmy.world 5 points 1 week ago

It does, but it's disabled by default. It's explicitly for docker compatibility though, not a core part of the application.

[–] ikidd@lemmy.world 2 points 1 week ago (1 children)

I've seen this done with namespaces as well. Which should work for podman.

[–] tofu@lemmy.nocturnal.garden 1 points 1 week ago (1 children)

How?

[–] ikidd@lemmy.world 3 points 1 week ago* (last edited 1 week ago)

userns-remap I remember seeing another method that was more manual that would have worked for Podman, but I can't seem to find it now.

[–] Cratermaker@discuss.tchncs.de 1 points 1 week ago (1 children)

Hmm this seems like a solution to an extremely specific problem that may have been created by using docker for things outside its wheelhouse. Why would I have docker automation that I only trust to do specific things?

[–] tofu@lemmy.nocturnal.garden 2 points 1 week ago

You might want a nice overview dashboard of your docker services but the tool shouldn't be able to interfere. I think homepage (the tool) was mentioned as an example since they have a docker integration that only needs reading access